e10e4e255af0ba3293aed0222096b70d627a0a8217f1d3d76c2d6813e3074144 | Triage

Analysis

max time kernel
1806s
max time network
1819s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-04-2024 01:23

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

899KB
MD5

9fdd70361cc0dcf3fda2020cad415b94
SHA1

94b6329920e8a70c5dca2d807401440ebea3e96a
SHA256

43b0db2ecb8147f6183021243f8cf233367c2689b601252834c20690ad092c97
SHA512

12214d8fc2af9ffac9dfa52eda2965e12a8f657eada8e70ff473a8c0d4f345e44740c0550d4f462ecec758ddb635d781368e9cf5f19098ff0eea872cf1a9db1a
SSDEEP

24576:IR9nl1crwjLAQw6Z5WUDYsH56g3P0zAk7:IR1l1culw6Z5WUDYsH56g3P0zAk7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2472	2648	rundll32.exe	29
PID 2648 wrote to memory of 2472	2648	rundll32.exe	29
PID 2648 wrote to memory of 2472	2648	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2648 -s 92
  2⤵
  PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads